The vulnerability of Cisco Enterprise NFV Infrastructure Software’s software infrastructure lies in improper validation of input data in NFVIS file system commands. This allows attackers to read or rewrite any files at will.

The vulnerability of Cisco Enterprise NFV Infrastructure Software’s software infrastructure is related to improper validation of input data in the file system’s command files. Exploiting this vulnerability allows a malicious actor to read or rewrite any arbitrary files remotely...

USN-4055-1 flightcrew vulnerabilities

Mike Salvatore discovered that FlightCrew improperly handled certain malformed EPUB files. An attacker could potentially use this vulnerability to cause a denial of service. CVE-2019-13032 Mike Salvatore discovered that FlightCrew mishandled certain malformed EPUB files. An attacker could use thi...

Vulnerability of the 2D component of the Java SE software platform, allowing attackers to gain full control over Java SE

The vulnerability of the 2D software platform of Java SE is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain full control over Java SE...

The vulnerability of the HP Support Assistant software, a centralized device management tool, stems from deficiencies in access control. This allows attackers to obtain system privileges and perform unauthorized changes to catalogs or files.

The vulnerability of the HP Support Assistant software for centralized device management is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to gain system privileges and perform unauthorized changes to catalogs or files...

Patch Tuesday Lowdown, July 2019 Edition

Microsoft today released software updates to plug almost 80 security holes in its Windows operating systems and related software. Among them are fixes for two zero-day flaws that are actively being exploited in the wild, and patches to quash four other bugs that were publicly detailed prior to...

The vulnerability of the Strife NT information protection system driver, related to deficiencies in access control, allows unauthorized access to information about file system objects.

The vulnerability of the Data Protection System’s driver for unauthorized access is related to deficiencies in access control for attributes of file system objects. Exploiting this vulnerability allows an intruder, operating locally, to gain unauthorized access to information about file system...

The vulnerability of the HTTP-server of the IDAL user interface design tool PB610 Panel Builder 600 (SAP500900R0101) allows a attacker to execute arbitrary code or cause a failure in the HTTP-server’s operation.

The vulnerability of the HTTP-server of the IDAL user interface design tool PB610 Panel Builder 600 SAP500900R0101 is related to errors in processing strings containing the user name or cookies during authentication processes. Exploiting this vulnerability could allow a malicious actor to execute...

Getting your head under the hood and out of the sand: Automotive security testing

We’ve been doing automotive pen testing for several years now. Along the way we’ve had some fascinating experiences, working with some insightful and forward-thinking OEMs. But we’ve also worked with some OEMs and suppliers that consider pen testing to be a box checking exercise and frankly, buri...

The vulnerability of the Intel Data Center Manager SDK, related to access control deficiencies, allows a perpetrator to disclose protected information.

The vulnerability of the Intel Data Center Manager SDK development tools is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to disclose sensitive information that is protected by these tools...

The vulnerability of the installation mechanism for the software development tools for Intel Data Center Manager SDK allows a perpetrator to disclose protected information due to security flaws in the mechanism.

The vulnerability of the mechanism for installing the software set for developing Intel Data Center Manager SDK is related to security flaws in this mechanism. Exploiting this vulnerability could allow attackers to disclose sensitive information that is protected by this system...

The vulnerability of the XMLDecoder component in Oracle WebLogic Server application servers allows a hacker to execute arbitrary code.

The vulnerability of the XMLDecoder component in Oracle WebLogic Server applications is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the Intel Data Center Manager SDK software development tools, related to access control deficiencies, allows a perpetrator to disclose protected information.

The vulnerability of the Intel Data Center Manager SDK development tools is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to disclose sensitive information that is protected by these tools...

Android July 2019 Security Update Patches 33 New Vulnerabilities

Google has started rolling out this month's security updates for its mobile operating system platform to address a total of 33 new security vulnerabilities affecting Android devices, 9 of which have been rated critical in severity. The vulnerabilities affect various Android components, including...

Foxit Reader < 9.3 Multiple Vulnerabilities (Jun 2019) - Windows

Foxit Reader is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:foxitsoftware:reader";...

Foxit PhantomPDF < 8.3.10, 9.x < 9.5 Multiple Vulnerabilities (Jun 2019) - Windows

Foxit PhantomPDF is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:foxitsoftware:phantompdf";...

Multiple F5 Products Security Bypass Vulnerabilities

F5 BIG-IP APM and so on are the products of F5 Corporation in the U.S.A. F5 BIG-IP APM is a set of access and security solutions.F5 BIG-IP is an application delivery platform that integrates the functions of network traffic management, application security management, and load balancing, etc. F5...

SUSE-SU-2019:1308-2 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 5 Fix Pack 35. Security issues fixed: - CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes bsc1134718. - CVE-2019-2698: Fixed out of bounds access flaw in the 2D component bsc1132729. -...

Account Takeover Vulnerability Found in Popular EA Games Origin Platform

A popular gaming platform used by hundreds of millions of people worldwide has been found vulnerable to multiple security flaws that could have allowed remote hackers to takeover players' accounts and steal sensitive data. The vulnerabilities in question reside in the "Origin" digital distributio...

The vulnerability of the Intel Turbo Boost Max Technology driver installation program allows a hacker to increase their privileges.

The vulnerability of the Intel Turbo Boost Max Technology driver installation program is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the Windows Common Log File System (CLFS) driver allows a hacker to gain full control over the system.

The vulnerability of the Windows Common Log File System CLFS driver in the Windows operating system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain full control over the system through a specially created application...